CISA Releases Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has released guidance addressing two critical vulnerabilities, CVE-2023-20198 and CVE-2023-20273, affecting Cisco’s Internetworking Operating System (IOS) XE Software Web User Interface (UI). These vulnerabilities, if exploited, allow an unauthenticated remote actor to take control of an affected system by creating a privileged account that provides complete control over the device.

The CISA guidance provides steps to mitigate these vulnerabilities, including:

1. Disabling the HTTP Server feature on internet-facing systems to prevent unauthorized access.
2. Hunting for malicious activity on the network to detect and respond to potential exploitation.

The vulnerabilities were actively exploited, and CISA urges organizations running Cisco IOS XE Web UI to review the guidance and implement the recommended mitigations immediately. The affected system is the Cisco IOS XE Software Web UI, which is a critical component of many network infrastructure devices.

Additional Resources

Cisco Security Advisory: Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature
Cisco Talos blog: Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities

Recommendations

Organizations running Cisco IOS XE Web UI should implement the mitigations outlined in the CISA guidance to prevent potential exploitation.
Regularly monitor system logs and network traffic for suspicious activity.
* Implement a vulnerability management program to stay informed about new vulnerabilities and their mitigation strategies.